CVE Database /
CVE-2021-24334
CVE · Medium
CVE-2021-24334 — Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy [instant-images] < 4.4.0.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24334
|
Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy [instant-images] < 4.4.0.1 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 4.4.0.1
|
4.4.0.1 |
2021-04-22 |
—
|
CVE-2021-24334
The Instant Images plugin prior to version 4.4.0.1 failed to adequately validate and escape the unsplash_download_w and unsplash_download_h parameters in the plugin settings page, relying instead on client-side validation alone. This weakness allowed attackers to inject and store malicious scripts that would execute in administrators' browsers when they accessed the settings interface.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings